Bug 2559276 (CVE-2026-114655)

Summary: CVE-2026-114655 libmongocrypt: libmongocrypt: Unauthorized key management operations via unvalidated request parameters
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libmongocrypt. The library constructs requests to external Key Management Service (KMS) providers without properly validating or encoding values sourced from key vault documents, provider configurations, or service responses. An attacker with write access to the key vault collection can manipulate request structures and inject arbitrary parameters or token claims that are signed using the application's credentials. This issue may allow unauthorized key management operations to be performed with unintended parameters, potentially leading to information disclosure or compromised cryptographic keys.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2562371, 2562373, 2562376, 2562378, 2562370, 2562380    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-22 20:01:23 UTC 
libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with write access to the key vault collection can alter the structure of these requests, including adding members to request bodies and token claims that the library then signs with the application's credentials. This may result in key management operations being performed with parameters the application did not intend.